Shirofune-Security f180ca72ae Merge latest dev before registry probe merge

2026-09-22 18:16:38 +09:00

..

ad-object-sacl.yml

Add opt-in AD directory object SACL profiles and recovery (issue #371)

2026-09-19 05:42:25 +09:00

adcs-auditing.yml

Resume a reviewed pending AD CS auditing restart (#431)

2026-09-21 09:16:39 +09:00

applocker-probe.yml

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

applocker-readiness.yml

Assess native AppLocker readiness and guard audit-only imports

2026-09-19 05:34:12 +09:00

applocker-script-probe.yml

Add fixed native AppLocker Script probe and disposable evidence matrix

2026-09-21 22:22:21 +09:00

audit-catalog-mappings.yml

Correct legacy token audit GUID and validate catalog mapping uncertainty

2026-09-19 07:01:50 +09:00

audit-integrity.yml

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

audit-notifications.yml

Add OneSettings auditing and Security warning controls (#408)

2026-09-20 13:55:24 +09:00

audit-precedence.yml

Verify advanced audit precedence before applying subcategories

2026-09-19 02:21:55 +09:00

audit-profiles.yml

Fix audit applicability, NTLM value types, and native exit verification

2026-09-19 00:36:38 +09:00

audit-recovery.yml

Add guarded value-only recovery for named logging DWORDs

2026-09-21 09:34:13 +09:00

audit-scoring.yml

Add transparent configuration and native rule readiness scores (#417)

2026-09-20 18:15:04 +09:00

capi2-probe.yml

Add fixed offline CAPI2 chain source probe

2026-09-21 17:51:31 +09:00

channel-read.yml

Verify actual current-token access to built-in event channels (#432)

2026-09-21 09:18:46 +09:00

channel-recovery.yml

Add reviewed recovery of one completed native channel operation

2026-09-22 07:52:16 +09:00

check-audit.yml

Provision DFS Namespace for full configuration CI

2026-09-19 05:05:47 +09:00

cli-arguments.yml

Reject unknown CLI arguments before legacy command dispatch

2026-09-21 22:16:44 +09:00

configuration-results.yml

Keep deferred configuration callbacks in script scope on PowerShell 5.1

2026-09-18 22:13:58 +09:00

control-applicability.yml

Gate historical controls and require evidence for Windows defaults (#409)

2026-09-20 14:00:10 +09:00

create-csv.yml

fix: update .gitignore and release workflows for new output files and README changes

2026-08-30 21:08:16 +09:00

create-rule-meta.yml

Assess native rule eligibility with explicit evidence gates

2026-09-19 07:24:04 +09:00

custom-audit-profiles.yml

Support validated custom audit profile files through the shared engine (#416)

2026-09-20 18:09:52 +09:00

dns-analytical.yml

Add guarded DNS analytical logging and stopped-trace archives (#425)

2026-09-20 22:49:52 +09:00

dns-client-probe.yml

Add fixed native DNS Client completion probe and acceptance fixture

2026-09-21 09:33:53 +09:00

docs.yml

docs: add Material for MkDocs documentation site (English + Japanese)

2026-06-29 09:50:48 +09:00

event-measurement.yml

Measure bounded native event delivery and verify exact EVTX samples (#430)

2026-09-21 09:14:48 +09:00

eventlog-recovery.yml

Add reviewed recovery of completed event-log size and retention changes

2026-09-21 17:42:52 +09:00

eventlog-settings.yml

Unify event-log size and retention profiles with verified configuration

2026-09-19 02:30:41 +09:00

evtx-recovery.yml

Verify native EVTX recovery under the actual primary reader token

2026-09-21 09:30:59 +09:00

failed-logon-probe.yml

Add a native local failed-logon audit probe (#444)

2026-09-21 22:13:20 +09:00

file-access-probe.yml

Bind observed native file paths and document exact read evidence

2026-09-21 22:40:50 +09:00

file-sacl-recovery.yml

Add guarded recovery for one selected leaf-file audit ACE

2026-09-21 10:03:00 +09:00

filesystem-sacl-lifecycle.yml

test: establish owned redirected-profile native SACL fixture

2026-09-22 11:49:31 +09:00

firewall-logging-recovery.yml

Cover CIS recovery paths and bound retained native evidence

2026-09-21 17:55:25 +09:00

firewall-logging.yml

Add opt-in native firewall text logging controls

2026-09-19 02:24:38 +09:00

gpo-audit-packages.yml

Add reviewable GPO audit-policy deployment packages (#415)

2026-09-20 18:13:34 +09:00

gpo-creation.yml

Create new disabled, unlinked GPOs from reviewed native audit backups (#427)

2026-09-20 22:53:00 +09:00

intune-audit-export.yml

Export native audit profiles for reviewed Intune client policies (#414)

2026-09-20 18:10:52 +09:00

ipsec-prerequisites.yml

Gate conditional IPsec auditing on native prerequisite evidence (#439)

2026-09-21 17:42:53 +09:00

ldap-diagnostics.yml

Make LDAP 1644 diagnostics explicit and preserve existing DC settings

2026-09-19 07:09:07 +09:00

native-channel-access.yml

Add opt-in native WEF channel settings and preserved CAPI2 read access

2026-09-19 05:36:29 +09:00

native-channel-configure.yml

Exercise public channel configuration on disposable Windows

2026-09-21 22:18:35 +09:00

native-onesettings.yml

test: exercise public OneSettings policy and Privacy channel configuration

2026-09-22 12:03:18 +09:00

native-profile-configure.yml

Exercise public profile configuration against native audit policy

2026-09-22 07:41:18 +09:00

native-provider-configure.yml

Validate public provider pack configuration on native Windows

2026-09-22 09:40:56 +09:00

native-provider-packs.yml

Add opt-in native DNS and provider audit packs (#411)

2026-09-20 13:58:49 +09:00

native-security-warning.yml

Verify public Security warning policy configuration on native Windows

2026-09-22 07:50:09 +09:00

native-smb-policy.yml

Verify public SMB audit policy configuration on native Windows

2026-09-22 09:41:04 +09:00

native-token-attribution.yml

test: bind native 4703 attribution to installed schema and exact restored context

2026-09-22 12:34:43 +09:00

native-validation.yml

Collect native 4688 validation components with a fixed benign probe (#413)

2026-09-20 18:08:34 +09:00

ntlm-auditing.yml

feat: configure selected incoming and domain NTLM audit policies

2026-09-22 12:03:11 +09:00

powershell-logging.yml

Add scoped Windows PowerShell logging policy and native validation

2026-09-22 14:37:38 +09:00

powershell-transcription.yml

Add opt-in Windows PowerShell transcription for CIS Level 2

2026-09-19 07:09:33 +09:00

process-commandline.yml

Add scoped native 4688 command-line policy configuration

2026-09-22 14:34:05 +09:00

registry-sacl-lifecycle.yml

test: run registry fixtures in explicit native shells and document evidence

2026-09-22 08:06:51 +09:00

registry-sacl-recovery.yml

fix: validate native empty catalogue and exercise registry recovery refusals

2026-09-22 10:57:17 +09:00

registry-value-probe.yml

Add fixed current-user registry value audit probe

2026-09-22 14:55:12 +09:00

release.yml

Merge latest dev before registry probe merge

2026-09-22 18:16:38 +09:00

retention-health.yml

Report native log retention and collection health evidence (#410)

2026-09-20 14:01:43 +09:00

rule-eligibility.yml

Use explicit Windows test shells and link eligibility changelog

2026-09-19 07:26:46 +09:00

scoped-outgoing-ntlm.yml

Add scoped outgoing NTLM audit configuration with native acceptance

2026-09-22 10:09:37 +09:00

selected-sacl.yml

Verify reviewed descendant SACL propagation and preservation (#429)

2026-09-21 09:12:56 +09:00

smb-auditing.yml

Add version-aware opt-in SMB audit policy controls

2026-09-19 02:33:13 +09:00

smb-runtime-activation.yml

Activate native SMB audit runtime switches explicitly (#441)

2026-09-21 18:09:10 +09:00

targeted-sacl-planning.yml

Plan targeted SACL prerequisites alongside audit profiles

2026-09-19 05:25:38 +09:00

test-domain-ntlm.yml

Report configuration-only audit states without rule coverage inference

2026-09-18 22:59:25 +09:00

test-native-audit-controls.yml

Add six missing native audit subcategories with source-specific masks

2026-09-18 21:58:33 +09:00

test-native-providers.yml

Assess native channels and provider prerequisites without static enabled claims

2026-09-19 02:29:56 +09:00

test-outgoing-ntlm.yml

Use explicit PowerShell shells in regression workflow

2026-09-18 21:49:46 +09:00

transcript-probe.yml

Use native module paths and transcript header command formatting

2026-09-21 09:53:50 +09:00

transcription-recovery.yml

Merge final dev and verify strict transcription recovery CLI

2026-09-21 18:22:31 +09:00

update-attack-remap.yml

feat: update MITRE ATT&CK Navigator heatmaps for ATT&CK v19 and handle revoked technique IDs

2026-09-04 05:08:35 +09:00

wec-authorization.yml

Review and update only source SID authorization on disabled WEC subscriptions

2026-09-22 07:50:50 +09:00

wec-collector-observation.yml

Use explicit supported shells for native collector smoke

2026-09-22 10:22:44 +09:00

wec-ingress.yml

Add reviewed scoped collector firewall ingress creation (#442)

2026-09-21 18:19:30 +09:00

wec-listener.yml

Create one reviewed exact-IP collector listener through a bounded native adapter

2026-09-21 22:58:08 +09:00

wec-runtime.yml

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

wec-state.yml

Review and apply existing WEC subscription enable/disable (#440)

2026-09-21 17:54:55 +09:00

wec-update.yml

Review and apply query updates to existing disabled WEC subscriptions (#426)

2026-09-20 22:51:01 +09:00

wef-arrival.yml

Verify native probe arrival in the local WEF collector (#418)

2026-09-20 19:26:57 +09:00

wef-deployment.yml

Add reviewed scoped collector firewall ingress creation (#442)

2026-09-21 18:19:30 +09:00

wef-query.yml

Add bounded native preflight for one selected WEF QueryList

2026-09-22 12:00:26 +09:00

wmi-descendants.yml

Reject unexplained descendant changes and unrelated WMI command arguments

2026-09-22 14:45:06 +09:00

wmi-namespace-auditing.yml

Verify native WMI SACL flags on disposable Windows namespaces

2026-09-19 06:20:32 +09:00

wmi-probe.yml

Use precise native UTC for WMI probe event intervals (#438)

2026-09-21 17:30:16 +09:00

wmi-sacl-recovery.yml

Add reviewed removal of one proven parent-only WMI audit ACE

2026-09-22 14:43:33 +09:00